CVE-2026-76904: 
Java vulnerability analysis and mitigation

CVE-2026-76904 is a critical SQL injection vulnerability in GeoTools, an open-source Java geospatial library, affecting the jsonArrayContains function in the PostGIS DataStore implementation. The vulnerability was published on August 21, 2026, and affects GeoTools versions 30.5 through 33.5, 34.0 through 34.4, and 35.0 when used with PostGIS 12 or greater and String or JSON fields. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The root cause is improper neutralization of special elements in an SQL command (CWE-89). The jsonArrayContains(<column>, <pointer>, <value>) function in FilterToSqlHelper.java writes the <value> parameter directly into the generated SQL query without escaping, allowing an attacker to inject arbitrary SQL expressions via OGC Filter requests. The fix, applied in commit d821c4d, introduces a escapeJsonLiteral() call before interpolating the value into the jsonb_path_exists expression. No authentication or special privileges are required, and the attack is conducted entirely over the network (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL commands with the privileges of the configured PostGIS database connection, resulting in high impact to confidentiality, integrity, and availability. Depending on database permissions, an attacker could exfiltrate sensitive geospatial data, modify or delete database records, or potentially escalate to operating system command execution via database features (e.g., PostgreSQL's COPY TO/FROM or pg_read_file). Applications built on GeoServer or other platforms that use GeoTools with PostGIS layers are also indirectly affected (GitHub Advisory).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication and no user interaction, making it trivially exploitable by any network-accessible attacker once a target is identified. The EPSS score is approximately 0.43%, reflecting low but non-negligible exploitation probability in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify internet-facing services using GeoTools with PostGIS DataStore (e.g., GeoServer instances), targeting versions 30.5–33.5, 34.0–34.4, or 35.0. Tools like Shodan or Censys can be used to find exposed OGC-compatible endpoints.
2. Identify OGC Filter endpoint: Locate a WFS or WMS endpoint that accepts OGC Filter expressions, such as a WFS GetFeature request with a Filter parameter targeting a PostGIS-backed layer with a JSON or String column.
3. Craft malicious OGC Filter: Construct an OGC Filter that invokes the jsonArrayContains function with a malicious <value> parameter containing SQL injection payload, e.g., jsonArrayContains(json_col, /key, ' OR 1=1--) or a more targeted payload to extract data.
4. Submit the request: Send the crafted HTTP GET or POST request to the OGC endpoint. The unescaped value is interpolated directly into the jsonb_path_exists(...) SQL expression executed against the PostGIS database.
5. Achieve objective: Depending on database privileges, extract sensitive data via UNION-based or error-based injection, modify records, or attempt OS-level command execution using PostgreSQL extensions (GitHub Advisory, Fix Commit).

• Network: Unusual or malformed OGC Filter requests (WFS GetFeature, WMS GetMap) containing SQL metacharacters (', --, OR, UNION, SELECT) in jsonArrayContains function parameters; unexpected outbound database connections from the application server.
• Logs: Application or web server logs showing OGC requests with encoded or raw SQL syntax in filter parameters; PostgreSQL logs recording unexpected or malformed jsonb_path_exists queries with injected SQL fragments; database error messages referencing syntax errors in dynamically generated SQL.
• Database: Unexpected queries in PostgreSQL pg_stat_activity or query logs originating from the GeoTools connection pool that contain anomalous SQL constructs; unauthorized reads from sensitive tables or schema enumeration queries (information_schema, pg_tables).
• File System: Unexpected files written via PostgreSQL COPY TO commands if the database user has file write privileges.

Patches are available in GeoTools versions 33.6, 34.5, and 35.1 — users should upgrade to the appropriate patched release for their branch (GeoTools 33.6 Release, GeoTools 34.5 Release, GitHub Advisory). No complete workaround exists; however, as a partial mitigation, the PostGIS connection pool should be configured with a least-privilege database account that restricts what SQL operations can be performed, limiting the blast radius of any successful injection. Organizations should prioritize upgrading immediately given the unauthenticated, network-exploitable nature of this vulnerability.

The vulnerability received coverage from The Hacker Wire, which published a technical article on the SQL injection via OGC Filters (The Hacker Wire). Community discussion appeared on Reddit's r/pwnhub and Mastodon, with general concern about the critical severity and unauthenticated attack vector. The Spanish national CERT (INCIBE) also issued an early warning advisory for the vulnerability.